Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An AWS account just for getting into other AWS accounts

src-bin.com

Post reply on HN
Print view View original

31–40 of 109 posts

Re: An AWS account just for getting into other AWS accounts

#31

Post by TYPE_FASTER »

dmak wrote: post #14
flyinprogrammer wrote: post #2

https://aws.amazon.com/controltower/ If we all started using Control Tower perhaps they'd get funded enough to continue to build it out and make it awesome.

I looked at the landing page, but don't really understand when I would use this. Could you give a few examples of why this is useful?

Centralized management and application of IAM policy with the goal of giving teams the freedom to manage their own account, including account security, while still protecting the organization as a whole.

When customers request single tenancy in the cloud, where single tenancy is referring to an AWS account, being able to automate account management will be important when trying to scale.

Re: An AWS account just for getting into other AWS accounts

#32

Post by abrookewood »

hatware wrote: post #13
metadat wrote: post #4

Earlier quoted context omitted.

Mr. Crowley, did you forget to mention / disclose your association and financial interest tied to this product? For context, https://www.linkedin.com/in/richarddcrowley indicates he works there.

What a weird comment.

Kind of .. I think it's good that people are encouraged to disclose their interests on HN as a matter of course.

Re: An AWS account just for getting into other AWS accounts

#33

Post by movedx »

reilly3000 wrote: post #15
benatkin wrote: post #9

What's this like on Google Cloud? Would you create a project to get into other projects and would that achieve most of what this achieves? And would you use a GSuite address so you don't log into the console just by logging into the email?

Everything in GCP is built atop the Google Auth system and tied to a GSuite domain. It’s Org->Folder->Project hierarchy is very similar to AWS Orgs. However, it’s far easier from there. IAM is tied to your gsuite email, and service accounts are also email addresses. One never needs to login with different creds to access another project. You just use your Google login or activate a service account. Projects are a rea…

> One never needs to login with different creds to access another project. You just use your Google login or activate a service account.

It's the same in AWS with AWS SSO/IAM Center. You only login once, and you can access every other account (project) you're allowed to access.

Re: An AWS account just for getting into other AWS accounts

#34

Post by datalopers »

scarface74 wrote: post #8

> If you wish to provide access via SSH… Don’t do this. I can’t think of a single reason that anyone ever needs to SSH directly into a server on AWS in 2022. Use System Manager Session Manager https://docs.aws.amazon.com/systems-manager/latest/userguide... Short explanation: it allows you to access a Linux instance via SSH using SSM as an IAM controlled proxy or use RDP for Windows. You don’t need ingress access to y…

A lot of us are busy solving business needs in smaller companies/startups and don't have the time nor expertise to learn every single AWS service and come up with a justification for utilizing it.

Re: An AWS account just for getting into other AWS accounts

#35

Post by epberry »

Very nice write up. As a billing guy I especially liked the tip about using resource policies to enable cross-account access and save on KMS request costs.

There's one issue with companies using hundreds of AWS accounts if you're a vendor to them: integrating services. Some folks here may be interested in a technique called "CloudFormation StackSets" which can deploy bits of infrastructure to multiple AWS accounts in one command. Vantage uses this to setup our billing integration and we wrote up the method here, https://www.vantage.sh/blog/using-cloudformation-stacksets-t...

Re: An AWS account just for getting into other AWS accounts

#36

Post by diceduckmonk »

benatkin wrote: post #9

What's this like on Google Cloud? Would you create a project to get into other projects and would that achieve most of what this achieves? And would you use a GSuite address so you don't log into the console just by logging into the email?

You can’t have nested projects, but for the purposes of organizations there is folders and orgs, which are container of containers.

GCP’s IAM somewhat addresses the isolation and scope problem mentioned in the article. Not all GCP apis, atleast with respect to OAuth2, properly utilize IAM, insofar that they require overly power OAuth2 scopes. For example, to list cloud functions you need permissions to create and edit, too. That’s broken.

In GCP, many orgs find themselves proliferating in projects because GCP’s billing is abstruse. People isolate resources to projects so they know how much specific services actually cost. This in turn presents another problem. GCP Web Console’s search doesn’t index well. For example, substring search doesn’t work on far too many resources. VMs are the exception, but we think this is inverted. Substring search should work on every resource, not be exceptional. Historically it didn’t even do cross project search. This is frankly not acceptable for a search company.

Re: An AWS account just for getting into other AWS accounts

#38

Post by manv1 »

diceduckmonk wrote: post #37

What tool do people here use to search across AWS accounts? Disclaimer: we are building a search engine to search for resources across “workspaces”. In AWS, this unit is the Account. In GCP, this unit is the Project.

That would be a handy tool.

Re: An AWS account just for getting into other AWS accounts

#39

Post by cjcampbell »

benatkin wrote: post #28
judge2020 wrote: post #17

Earlier quoted context omitted.

For enterprises it seems this is already baked-in, ie. when you're a Google Workspace (previously GSuite) user, your project selector has an inherent hierarchy stemming from the domain, ie. example.com -> project1, project2, etc. and, in my limited experience, switching between accounts on the command line is pretty good. But this article still makes a good point about keeping different environments in different silo…

It seems that with isolation between projects on gcloud the number of separate accounts needed is less, which is good because it's also harder and more expensive to create multiple accounts. If gsuite is used very carefully, 1 is enough, but I think 2 would be better for most.

I'm assuming you're saying a dedicated account for Google Workspace (GSuite) and a separate account for anything GCP?

Re: An AWS account just for getting into other AWS accounts

#40

Post by throwawaaarrgh »

For an IdP it seems like Dex combined with an LDAP server would be the simplest and most flexible solution. For reliability, I'm curious about throwing together a really simple LDAP server that stores records in AWS S3. That way your IdP can be trivially replicated with as much reliability as you want and nearly no maintenance. (Dex's storage can be Etcd, but I would also look to implement S3 storage)
Post reply on HN